whitepaper Marketing CAN-SPAM Compliance Overview

Transcription

1 Design Marketing Tips for Outlook CAN-SPAM 2007Compliance whitepaper Marketing CAN-SPAM Compliance Overview The CAN-SPAM Act (the Act ) passed with a nearly unanimous vote in both the House and Senate and was signed into law by President Bush in December of The Federal Trade Commission (FTC) along with numerous Internet Service Providers (ISPs) has since used the law to take action against bad actors in the space. This whitepaper explores the practical and legal aspects of the CAN-SPAM Act and provides advice about minimizing the risks of marketing. remains one of the most effective vehicles for marketing, communication, and customer retention, and organizations that enact sending best practices will reap the long-term rewards of positive sending reputations, higher customer loyalty, and spotless ISP relationships. Marketers Beware The Act is designed to target the most egregious spammers and their fraudulent and deceptive practices not to hinder the sending practices of legitimate businesses. However, the CAN-SPAM Act can cause some potential pitfalls for unwary marketers. Those that fail to implement sending best practices and abide by the rules outlined in the CAN-SPAM Act could face fines, costly lawsuits, or worse yet prison. Yet, implementing change across enterprises can be challenging, especially for marketers who don t realize their organizations are at risk. It is, therefore, vital that all marketers sending outbound marketing messages whether promotional, educational, or otherwise familiarize themselves with the CAN-SPAM Act and make sure their marketing programs are compliant. Raising the Bar FTC Passes New CAN-SPAM Rules This whitepaper gives marketers guidance regarding the FTC s CAN- SPAM Act, including its new rules effective July 7, 2008 regarding: 1. Liability Clarifications (see page 3) 2. Post Office Box Address Notations (see page 5) 3. Unsubscribe Requirements (see page 6) 4. Definition of Sender (see page 11) The scrutiny of marketing affects not only legislation and litigation, but also the processing industry. With encouragement from anti-spam action groups, most ISPs and anti-spam filtering technologies have set the bar much higher for marketers than even state and federal laws legally require. Aimed at reducing the amount of SPAM consumers receive, senders suffering from high rates of undeliverable s or SPAM complaints are often filtered by ISPs. This whitepaper is divided into three sections that will help your organization stay CAN-SPAM compliant: Part One: Exploring the CAN-SPAM Act (Page 2) Part Two: Common CAN-SPAM Pitfalls And How to Avoid Them (Page 8) Part Three: Raising the Bar Permission and Deliverability (Page 13) How Good is Your Reputation? Download The Reputation Equation: Marketing & ISP Relationships from to get best practices and tips for improving your ISP sending reputation ExactTarget. All rights reserved.

2 Part One: Exploring the CAN-SPAM Act This section summarizes the major provisions of the CAN-SPAM Act, including: CAN-SPAM Act Overview What is Criminal Civil Actions and Penalties Required Commercial Content CAN-SPAM Act Overview The U.S. Senate Commerce Committee defined the CAN-SPAM Act as follows: The purposes of this legislation are to: (i) prohibit senders of electronic mail ( ) for primarily commercial advertisement or promotional purposes from deceiving intended recipients or ISPs as to the source or subject matter of their messages; (ii) require such senders to give recipients an opportunity to decline to receive future commercial from them and to honor such requests; (iii) require senders of unsolicited commercial (UCE) to also include a valid physical address in the message and a clear notice that the message is an advertisement or solicitation; and (iv) prohibit businesses from knowingly promoting, or permitting the promotion of, their trade or business through transmitted with false or misleading sender or routing information. Commercial or Transactional? Wondering which of your s are covered by the Act? Request a copy of the Transactional v. Commercial Data Sheet from an ExactTarget representative. The Act prohibits predatory and abusive commercial practices, and restricts the transmission of certain s that do not include proper disclosures regarding their nature and origin. Specifically, the law clearly prohibits commercial transmissions after a recipient has opted-out of receiving such communications from the sender. With the Act in place, legitimate senders can now focus on complying with a single law, instead of juggling differing state regulations. The law also prevents nuisance lawsuits that in the past could have been brought by individuals under these varying state laws, including private rights of action. Commercial v. Transactional Only commercial is regulated by the CAN-SPAM Act the law does not regulate transactional or relationship messages (primary purpose is non-commercial). Transactional messages might include communications like purchase and shopping confirmations (even if the messages relate to a consumer s commercial transaction), health or safety updates, recall notices, or employment communications. Transactional Marketing Want to learn more about transactional ? Download the Transactional Marketing Whitepaper from 2

3 What is Criminal? The Act prohibits certain predatory and abusive commercial electronic mail. Section 4 of the Act generally addresses the manipulation of subject lines, headers, and origination information used to evade detection by ISPs and filters. The section then provides specific penalties for initiators of such acts (and conspirators) including imprisonment, fines, and forfeiture of property used or gained in commission of the offense. In May 2008, the FTC added a definition of the term person in order to clarify that the law s obligations are not limited to natural persons. This essentially means that the scope of the Act includes individuals, groups, unincorporated associations, corporations, and nonprofits. All of these groups must comply with the CAN-SPAM Act. Prohibited Under Section 4 of the CAN-SPAM Act: Hiding Origin By Using Other Computers (Hacking and Relaying) Accessing a computer without authorization to initiate the transmission of multiple s is prohibited. Similarly, using a computer to relay or retransmit multiple messages with the intent to hide the origin of the message is prohibited. Spammers sometimes use different computers with or without permission to hide the true origin of an (thus, evading filters and other blocking techniques used by ISPs). Beg, Borrow, and Steal Some spammers try to hide the origin of their s by using other computers to transmit messages. Such actions are prohibited by the CAN-SPAM Act. False or Misleading Header Information Spammers often try to disguise their sending identity by falsifying header information, typically the only portion of the message seen by the receiving mail server. Spammers constantly change and falsify header information in an effort to avoid detection, confuse SPAM filters, and allow them to continue sending SPAM. The CAN- SPAM Act prohibits the initiation of multiple s with materially falsified header information. Deception in Registration, Domain Names, and Ownership of IP Addresses The Act prohibits initiating multiple s from an account where the initiator has registered five or more accounts or two or more domain names using information that materially falsifies the registrant s true identity. The Act further prohibits initiating multiple s from an IP address when the initiator has falsely represented he or she is the registrant of the address. Violations of the above provisions may result in fines or up to five years imprisonment, depending on the seriousness of the violation and other factors. Section 4 of the Act provides for forfeiture of property used in connection with the commission of the offense, gained in, or traceable to the commission of the offense. The Act directs the U.S. Sentencing Commission to amend sentencing guidelines to provide specific, appropriate criminal penalties. 3

4 Civil Actions and Penalties Section 5 of the Act provides additional protections in the form of civil actions. However, the law does not provide a civil cause of action for individuals against violators of the CAN-SPAM Act. Instead, the Act empowers the Attorneys General of each state to pursue violators of certain parts of Section 5 on behalf of the residents of their states. Additionally, the following guidelines apply to civil actions and penalties: An Attorney General can also pursue money damages, injunctive relief to stop further violations of the Act, or statutory damages up to $2,000,000. Just the Facts Ma am The CAN-SPAM Act does not permit suits to be brought by individuals. Only certain federal agencies, state attorneys general, and ISPs can enforce the provisions of the Act. Penalty values may be increased for the inclusion of false or misleading information or if circumstances support a finding of aggravated damages. Statutory damages can reach up to $250 per address to which an is sent. A court may increase awarded damages if it finds aggravating circumstances. At its discretion, it may also award attorney fees for successful actions. Certain federal agencies may file a civil action under the law, and ISPs are provided a civil cause of action against violators of certain sections of the Act. Finally, the Act generally can be enforced by a variety of federal agencies noted in the Act when the actions (or actors) fall within the agency s jurisdiction. 4

5 Required Commercial Content According to the Act, commercial marketers must include several types of information before sending messages to any recipient. Marketers should work with their legal counsel to make sure communications are compliant in each content area. The CAN-SPAM Act requires the following: All Commercial Must Contain a Valid Opt-Out Mechanism Every commercial message must contain a valid mechanism allowing the recipient to unsubscribe (preventing them from receiving any further s from the associated sender). Opt-out information must be provided clearly and conspicuously in each message. Companies can provide a generic opt-out from all communications or a more specific menu of options to permit recipients to opt-out of certain types of commercial s as long as recipients are also given the option to opt-out of all communications. Easy Opt-Out Every commercial must include a clear and ideally instantaneous opt-out mechanism. Opt-Out Requests Must Be Honored Within 10 Business Days The original law allowed the FTC to later set a different number of days requirement. However, in May 2008, the FTC reaffirmed its 10 business day requirement. Most list management tools and Service Providers (ESPs) effectively handle unsubscribe or opt-out requests immediately a best practice all marketers should embrace. However, the ten day window allows for appropriate management of opt-outs in various scenarios, including data synchronization across multiple systems that may only be configured periodically. Sender Must Include a Valid Physical Postal Address Senders must include their physical postal address in the body of every message. In May 2008, the FTC clarified that a post office box or similar postal address will satisfy the requirements of the Act. What About Post Office Boxes? As of May 2008, Post Office Boxes (and similar addresses) are acceptable forms of physical address in an message. 5

6 Opt-Out Process Must Be Uncomplicated In May 2008, the FTC issued updated rules that clarified the opt-out process as required by the Act. The rules indicated the consumer opt-out process may not be conditioned on the payment of any fee. In addition, the opt-out mechanism must only rely on the consumer s input of an address. The opt-out process cannot require a password (or any other information) which may act as a barrier to the consumer s ability to unsubscribe. The opt-out mechanism must rely on either a reply-to mailbox ( -based process) or a visit to a single webpage (web-based process). Assuming a web-based process, any opt-out link in a commercial message must link directly to a page where the recipient can immediately opt-out of further messages. The FTC indicated that multiple steps to verify the identity of the recipient, log-ins, or other account confirmations are unnecessarily burdensome and no longer allowed. Subscription and Profile Centers Subscription Centers should include clear opt-out links (without requesting any more subscriber information than an address). ExactTarget automatically adds an Unsubscribe From All link to your Profile Center to follow this best practice. 6

7 If Unsolicited, An Must Provide a Clear Notice That It Is An Advertisement The law does not make a recommendation for the specific language to be used to fulfill this requirement, or how it is to be positioned in the . Note: this does not make unsolicited commercial s acceptable to ISPs; they can and do set higher permission-based standards for marketers. Operative Opt-Out Mechanism Requirement A valid return address (or comparable Internet-based communication technology) must allow a recipient to opt-out of future communications, and the operative opt-out mechanism must be available for at least 30 days following a mailing. The Act provides leniency for temporary outages. Senders Must Label Sexually-Oriented Messages For s containing adult or sexual content, senders are required to include the warning, SEXUALLY-EXPLICIT: in the subject line. The Act outlines additional requirements and penalties for messages involving sexually-oriented material. No False, Deceptive, or Misleading Transmission Information or Subjects This requirement focuses on deceptive practices often used by spammers to avoid filters and encourage recipients to open a message and respond to a false offer or scam. Note: The Act specifies that s containing accurate identification of the message s initiator are not classified as false or misleading. Mistaken Identity Sample phishing illustrates sender posing as a recognized brand in order to trick recipients into sharing personal information. 7

8 Part Two: Common CAN-SPAM Pitfalls And How to Avoid Them At first glance, the CAN-SPAM Act establishes fairly basic rules for an organization to follow. However, given that this law is constantly evolving (as seen when the FTC enacted four new rules in May 2008), new details and judicial interpretations will surely follow. marketers must remain alert to changes and proactively avoid the common pitfalls outlined below. 1. Develop and Enforce an Enterprise-Wide Unsubscribe or Opt-Out Process The Act s opt-out requirement states: Require such senders to give recipients an opportunity to decline to receive future commercial from them and to honor such requests. To ensure your organization is compliant, ask yourself these important questions: Is your company technically prepared to manage and maintain not just one but potentially several suppression lists of recipients who don t want to receive commercial ? Do you have a method to control opt-out requests and suppression lists across all departments within the enterprise? Do you have the technological capability and capacity to log and maintain a master suppression list and several more specific suppression lists simultaneously? Do you have the decision-making and communication procedures in place to determine when a subscriber has opted-out of all (versus only some) future communications, and to inform your database administrator of subscriber changes? Can your company make appropriate permission changes within ten business days of that opt-out request as required by the Act? Get Organized Every ExactTarget automatically provides a link to a Profile Center, which gives subscribers the option to opt-out of specific communications or all communications. What does that mean for the marketer? Organized suppression lists and peace of mind. Can database updates be communicated to all locations of your company s enterprise that use this data quickly enough to prevent another area of the company from contacting an unsubscribed user after 10 days have passed? Addressing these questions can be challenging, especially for organizations with disparate data sources, decentralized marketing programs, several physical locations, or multiple divisions or processes. But the stakes for ignoring the Act s requirements are high, and a failure to properly handle opt-out requests can lead to prosecution and severe penalties. Organizations must make a concerted effort to not only implement the proper technology to handle opt-out processes, but also to ensure the philosophy of honoring that opt-out is adopted at every single customer touch point from the CEO to a local sales representative. If systems cannot support centralized unsubscribe list management efforts, organizations should consider offering employee education and training about the risks associated with commercial marketing and the CAN-SPAM Act. 8

9 One option for managing unsubscribes in a central location is engaging a single provider. ESPs like ExactTarget have the ability to manage unsubscribe data in a centralized and secure location, instead of managing data across multiple divisions of the organization. In addition to the fact that ESPs have experience managing and the complexities of list removal, data centralization provides an easy way for marketers to streamline multiple communications and clean subscriber data. It also provides enterprise-level security that assets are stored in a secure, encrypted environment. 2. Enforce CAN-SPAM Compliance with Every and Every Employee The Delivery Guru Look for more insights about the world of CAN-SPAM compliance and marketing deliverability from ExactTarget s Director of Privacy & Deliverability. Check out Al Iverson s blog, The Delivery Guru, at Individual employee s present a substantial risk to companies lacking a central control point over their communications. As the Act provides, organizations and their agents (employees, contractors, etc.) must honor the recipient s request to stop further mailings. Legal ramifications can result from as few as one employee s poor decision to send an to a recipient who has opted-out. It Only Takes One Be sure every employee understands proper permission procedure, and that every commercial is compliant with CAN-SPAM. One mismanaged commercial is enough to cause serious trouble with the FTC. 9

10 3. Develop a Strategy for Capturing Affirmative Consent CAN-SPAM provides advantages to organizations that only send to recipients who have opted-in to their communications. Per the Act, affirmative consent (also referred to as permission marketing, explicit opt-in, or direct consent) exists if a recipient has expressly consented to receive the message, either in response to a clear and conspicuous request for such consent or at the recipient s own initiative. When affirmative consent is obtained, commercial labeling requirements no longer apply. For example, a company that promotes products through an promotion to consumers who have willingly provided their addresses to receive such promotions does not need to include an advertisement label on their s. This is advantageous as such advertising labels which can be easy targets for SPAM filters. 4. Don t Send Unsolicited Messages The law states that in the case of unsolicited commercial messaging, all messages must be clearly identified as an advertisement or solicitation (though the Act does not specify the exact labeling method required). marketers need to be aware that ISPs commonly block messages with such labels. So senders who have to label a message as a solicitation or advertisement will nearly guarantee that it will be widely filtered or blocked by ISPs. While the law effectively allows the sending of unsolicited commercial if all applicable requirements are followed, it does not prohibit ISPs and SPAM filtering service providers from discarding or refusing to deliver unsolicited mail. The vast majority of ISPs and ESPs have policies prohibiting the sending of unsolicited commercial messages from their networks (or to their users) and are quick to block messages they deem unsolicited commercial . As a best practice, companies should never send unsolicited messages. Walks Like SPAM, Talks Like SPAM The law allows the sending of unsolicited commercial if applicable requirements are followed, but ISPs and SPAM filtering service providers are still allowed to discard or refuse to deliver unsolicited . 10

11 The law might also cause an organization to ask what should happen when a consumer visits its website and provides an address as part of a request for information. Does the Act require them to send in response to the inquiry which includes an optout, valid physical address, and reply address? The Act defines a commercial electronic mail message as any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service. Therefore, if an is a first communication with a recipient and is truly in response to the consumer s inquiry, arguably the primary purpose is not to advertise or promote. Rather, its purpose is to respond to an inquiry from the consumer. However, subsequent communications or promotions for products and services should include an opt-out, valid physical address, and reply address per the Act. Creating a method to capture affirmative consent such as an opt-in checkbox on a web form provides clarity about whether future subscriber s are warranted. Though a physical postal address and unsubscribe mechanism are required, a company might be able to avoid the commercial labeling requirement if it secures affirmative consent. For more information on affirmative consent and permission marketing, see Part Three of this whitepaper. 5. Be Careful When Relates to a Particular Business Segment The Act provides, if an entity operates through separate lines of business or divisions and holds itself out to the recipient throughout the message as that particular line of business or division rather than as the entity of which such line of business or division is a part, then the line of business or the division shall be treated as the sender of such message for purposes of this Act. Under the law, a sender is defined as the entity whose goods or services are advertised in a commercial message. Updated rules provide a clearer definition of sender, and make it easier to determine which of multiple parties advertising in a single message is responsible for complying with the Act s opt-out requirements. The sole sender appearing in the from line of the becomes the designated sender of the message and must comply with all provisions of the Act (such as listing a physical postal address and providing an opt-out mechanism). When In Doubt, Opt Them Out If subscribers might assume their optout applies to more than one business unit, remove them from all related lists just to be on the safe side. In other words, if a particular business division sends an which indicates it is an advertisement from that division, the parent organization can continue to send s to recipients that have opted-out to communications from the division. Organizations should implement procedures and educate their divisions, business units, and other affiliates to clearly indicate the sender on every message and specifically to identify the business division from which the subscriber can opt-out. If a commercial transmission could be mistakenly understood as originating from the parent organization, it is even more important to clearly identify the particular line of business or division as the sender. The most conservative approach is to eliminate the recipient from all of the lists of the related companies. 11

12 6. Avoid Misleading Subject Lines In the past, marketers could achieve significantly higher response rates by using promotional language and teasers in a subject line that enticed recipients to open the . For example, a legitimate anti-virus software company might use the subject line: Your computer may be infected to encourage recipients to open its message. But today, the same subject lines are easy targets for SPAM filters and may actually violate the Act. Times are Changing And your subject lines must change with them. The teaser phrases that were successful in the past often throw red flags for today s SPAM filters. Companies need to educate employees and develop internal communication processes to ensure that its marketers are aware of similar constraints on their creative licenses. Specifically, companies should develop a review process to ensure subject line restrictions are upheld. And when in doubt, marketers should consider the standpoint of the reasonable recipient to determine if a subject line is misleading or could be misinterpreted. 7. Obtain Opt-In for Wireless Communications The CAN-SPAM Act requires that companies obtain opt-in for commercial messages sent to wireless devices or cell phones. Under FCC , any commercial sent to a wireless device domains must obtain express prior authorization and an e-signature for all wireless domain subscribers. While some domains in this category are excluded, a full list of affected domains can be found here: The net effect of these restrictions and requirements is such that sending commercial messages to addresses at mobile service domains is not allowed. ExactTarget keeps a synchronized copy of all of the mobile service domains identified by the FCC (based on information provided by those service providers) and prohibits users from importing addresses that are prohibited and would violate the CAN-SPAM Act. 8. Refrain from Harvesting Addresses & Dictionary Attacks Harvesting typically refers to the automated harvesting of addresses from websites. Spammers often employ this tactic using software developed specifically for the purpose of harvesting addresses. Dictionary Attacks refer to spammers tactic of guessing addresses using an algorithm or dictionary-type tool to search for addresses. Dictionary Attacks can produce strings like ajohnson@hotmail.com, bjohnson@hotmail.com, cjohnson@hotmail.com, etc. Marketing for the Third Screen For more trends and tips regarding mobile marketing, download the Marketing for the Third Screen Whitepaper from The CAN-SPAM Act generally provides for damages of $250 per violation up to $2 million dollars (or more for violations involving a false or misleading transmission of information), but these damages may be increased for willful violations or violations where Harvesting or Dictionary Attack tactics are used. For civil action suits initiated by ISPs, damage caps for these violations are somewhat reduced. 12

13 Part 3: Raising the Bar Permission and Deliverability Some CAN-SPAM Act opponents do not believe that the Act effectively reduces SPAM. They argue that by allowing unsolicited commercial as long as an opt-out and physical addresses are present, the government is essentially legalizing SPAM. However, the anti-spam community and ISPs have long opposed any marketing situation where affirmative consent does not exist. ISPs filter billions of SPAM messages daily, and SPAM prevention is seen as a worthy cause for millions of subscribers whose inboxes are frequently flooded with fraudulent s, bogus health claims, and pornography. CAN-SPAM is somewhat sympathetic to the plight of ISPs and states that it shall have no effect on policies of Internet access service. The Act, therefore, does not preempt the more stringent SPAM requirements of ISPs (unlike the laws of certain states which are preempted by the law). To improve deliverability with ISPs, filtering companies, and anti-spam blacklist organizations, senders should consider the following recommendations. Deliverability Report Card ExactTarget s Deliverability Report Cards help marketers keep track of their standing with major ISPs, SPAMCop complaints, and other essential delivery metrics. 1. Play by the Rules of ISPs and Filtering Companies Inboxes are more crowded than ever, and many ISPs are diligent about blocking all messages they believe may be SPAM. However, an unfortunate portion of these blocked s originate from legitimate companies that are simply unaware of underlying ISP SPAM filtering logic. As a result, legitimate s are often filtered (a scenario known as false positive filtering ) before ever reaching their intended recipients. ISPs often combine content filtering mechanisms which scan subject lines and body content to determine which s are SPAM with other types of filters that check for number of complaints received for a specific sender. They may also look at the number of undeliverable s generated by a specific mailing when deciding whether to filter a message. Senders who deploy high quantities of promotions, send to dirty lists, or generate many complaints (who look like spammers to ISPs) are blocked. Though ISP filters are built on averages (and are therefore imperfect), they are a reality of sending commercial in today s SPAM-sensitive environment. False positive filtering sometimes occurs for s from legitimate marketers due to the commercial content of the messages. However, false positives are most prevalent with that is unwanted by recipients. Organizations should not underestimate the power of ISPs and other organizations using SPAM filtering their control over the delivery of messages only continues to increase. Are You Getting Through? Monitor your delivery success with major ISPs with edelivery Tracker, one of several advanced deliverability tools available with ExactTarget s Inbox Detective. 13

14 2. Reduce SPAM Blocking with Permission-Based Marketing Permission-based marketing is extremely important to the success of any company s marketing efforts, and provides significant deliverability and economic benefits. Also known as opt-in marketing, permission-based marketing describes sending to only those recipients who have asked to receive information from a specific company via . Organizations should strive to use standards set forth by emarketing pioneer Seth Godin, author of Permission Marketing, who proposes all marketing messages must be anticipated, personal, and relevant. By opting-in to communications, a subscriber has given permission to receive a type of message and it is the sender s responsibility to deliver (not abuse) that relationship. Building a Permission-Based Opt-In List Developing a permission-based list takes time, but the benefits far outweigh the effort. An organization focused on list growth can effectively build its permissionbased lists by capturing opt-ins at each customer/prospect touch point like at point-of-sale, on a sign-up form, kiosk, website, or during a phone call. As long as the subscriber willingly requests information via , his or her opt-in can be considered permission-based. Giving subscribers the power to choose their communication types, channels, and frequencies, helps companies build higher quality permission lists. Subscribers who specifically request information via are less likely to file SPAM complaints, and their messages are less likely to be filtered to the junk folder or discarded. Mailing to addresses gathered without subscriber knowledge or approval violates the Act. Such activities will generate more SPAM complaints that damage the sender s reputation with ISPs and jeopardizes future deliverability success. Permission-Based Marketing Want to learn how to execute an effective permission-based marketing program? Download ExactTarget s Permission-Based Marketing Whitepaper at Enterprises must also be wary of the ways in which their employees gather addresses. As opposed to Harvesting and Dictionary Attacks, there are several ways in which an employee might unwittingly gather addresses in an unsolicited fashion. For example, imagine Joe is an employee of XYZ Company. While attending a networking function, he collects business cards from several prospective clients. Although Joe has not asked each of these prospects permission to send them communications, he returns to work the following day and adds them to his company s master subscriber list. Mailing to these individuals violates the CAN-SPAM Act, and could lead to ISPs blocks, SPAM complaints, blacklists, or civil actions against XYZ Company. The best practices in this situation would have been for Joe to instead follow up with the prospective clients with a phone call. During the call, he could gain each person s consent and add his/her name to XYZ s mailing list. Alternatively, he could focus on capturing written consent at the networking function before adding the addresses to the list. Or, Joe could send a personal to each prospective client to express his pleasure in meeting the prospect and to request permission to send information in a future communication. List Growth the Right Way Learn how to build a permission audience-based list the right way by downloading the Hershey Entertainment & Resorts Case Study at 14

15 3. Move to Double Opt-in to Reduce Threat of Blacklisting Third-party anti-spam blacklists (also called block lists ) are SPAM-filtering plugins (often free) that the majority of server administrators can subscribe to. Senders who violate perceived best practice guidelines often find their sending IP addresses listed on one or more of these blacklists. servers that subscribe to the blacklist are then likely to reject all sent from blacklisted sender IP addresses. This can have a substantial impact on deliverability as a substantial percentage of an organization s is filtered before reaching the inbox. Spread the Word One blocked from one employee s address can put the entire enterprise at risk for filtering and blocks. Organizations that find their IP addresses on a blacklist are often required to prove they use permission-marketing practices before they will be removed from the blacklist. Blacklist removal requirements can vary greatly, and some blacklists may require that an ISP or ESP terminate services to the organization that caused the blacklisting before the IP address will be removed. To avoid blacklisting, organizations should always follow opt-in best practices. Permission may be qualified into two categories: single and double opt-in. Single opt-in is simply capturing approval from a subscriber to send them . Double opt-in (also called confirmed opt-in) utilizes address verification to ensure permission and log opt-in consent from the end recipient. In a double opt-in scenario, a welcome message (called an opt-in confirmation ) is sent to the subscriber. The recipient is considered opt-in only if he or she clicks on the link contained in the opt-in confirmation message. If the end recipient does not click, he or she should not to be considered opt-in or not receive any further messages. Your organization may want to consider using double opt-in to: Keep Your Lists Clean By requiring a second opt-in confirmation, organizations reduce the risk of adding misspelled or fraudulent addresses to their list. Mailing to bogus addresses raises the number of undeliverable s and increases the likelihood of filtering. It can also result in mailing to SPAMtrap addresses put in place by ISPs and filtering companies to trap unwary companies. Be Above Reproach Double opt-in addresses provide assurance as well as an electronic record that affirmative consent is in place should the company need to validate sending practices or defend against potential litigation. Perfect Your Opt-In Process Request a copy of the Opt-In Best Practices Data Sheet from an ExactTarget representative, and make sure your processes are above reproach. Guard Against SPAM Complaints Double opt-in subscribers are much less likely to complain or misidentify an as SPAM. Maintaining a low complaint rate is key to preventing ISP blocking and filtering. 15

16 4. Maximize Delivery with Opt-in Reminders Since subscriber complaints are a large component of the logic used by many filtering mechanisms, subscriber recognition of an organization and a recollection of their opt-in determines the likelihood that a recipient will file a SPAM complaint. Subscribers receiving that is expected, branded, and easy to recognize are unlikely to mistake a message as SPAM which in turn reduces the potential for filtering. For example, the best practice to improve recognition at the time of website name capture is be for an organization to list the type of which will be sent, the name of the publication, its frequency, and who it will be from. This sets expectations with subscribers and reduces the chance of complaints and filtering. Another step many organizations are taking to improve recognition and add credibility to their mailings is adding a short text reminder at the top of each . For example: You are receiving this mailing because you opted-in to receiving s from xyzco.com. Please add abc@xyzco.com as a Safe Sender in your address book. Providing text that asks each subscriber to add the sender to his or her address book will help organizations make it to the inbox, rather than having their messages routed to the bulk or junk folders. Major ISPs such as AOL, Yahoo!, MSN /Hotmail, and Microsoft Outlook route sent from senders on their users safe sender lists past SPAM filters. 5. Maintain a Consistent From Address and Subject Line Recognition It is important for organizations to maintain a consistent from name in their s for a number of reasons. First, it is an important element of recognition, and studies prove that a majority of users first look at the from name when determining whether or not they open a message. Organizations that use a consistent from name also benefit because their subscribers grow accustomed to receiving s from a particular address and begin to anticipate these messages. Second, maintaining a consistent from name will help organizations leverage the benefits of being in their subscribers safe sender address books. Another step organizations can take to ensure their subscribers recognize their s is to include the name of their organization in the subject line. The CAN-SPAM Act requires the subject line of a commercial not be misleading or fraudulent. But going a step farther by adding the company name to the subject line not only adds credibility, but also increases recognition and reduces the potential for subscriber complaints and subsequent filtering. Consult Your Legal Counsel These materials do not constitute specific legal advice and may not address all aspects of a legal development relevant to your circumstances. Consult legal counsel to determine how laws apply to your specific situations. Further, these materials are not intended to create, and receipt of them does not constitute, a lawyer-client relationship. Copyright ExactTarget and Ice Miller 2008 Summary With the passage of the Federal CAN-SPAM Act, marketers need to be aware of both the practical and legal aspects of sending commercial . The requirements of the Act will have significant impact on unwary organizations or those that fail to adjust internal procedures appropriately. However, organizations that take the proper steps to overcome challenges and risks will reap the rewards of subscriber loyalty in the long run. 16